Security

Last updated 3 September 2026 · Applies to the Ahead staging environment

Accounts and sessions

• Passwords are stored only as salted hashes. We never hold, log or email your password.
• Sessions are server-side. The cookie carries a random token; the authority is a row in our database, so revoking a session actually revokes it rather than asking the browser nicely.
• The session cookie is HttpOnly (JavaScript cannot read it), SameSite=Lax (it is not attached to cross-site requests, which is our CSRF protection), and Secure on every deployed environment.
• Password reset tokens are stored only as hashes, are single-use, and expire in one hour. Successfully resetting a password revokes every existing session on the account.
• Signup is protected by a bot check (Cloudflare Turnstile), verified server-side.

Tenant isolation

Every data query in the product is bound to the user identity resolved from your session. Where a user id appears in a URL it is treated as a claim and checked against your session — it never selects the data. One account cannot read another's profile, opportunities, applications or audit trail, and this is covered by a dedicated automated test suite rather than by convention.

Payments

• Card details are entered on Stripe's own checkout and go directly to Stripe. Ahead never sees, transmits or stores a card number, and is therefore not in scope for card data handling.
• Payment confirmations arrive as Stripe webhooks whose signatures we verify cryptographically, with a timestamp tolerance that prevents a captured webhook from being replayed later.
• An environment with no payment provider configured refuses to take payment rather than falling back to anything permissive.

The audit trail

Ahead keeps two separate append-only logs. One records every application attempt and its verified state changes, as a hash chain that can be independently verified for tampering. The other records every time your personal information was read, written or disclosed, and you can read it yourself at your privacy activity log.

Analytics cannot become a shadow copy of your data

Product analytics run through a rejecting scrubber: a property that looks like an email address, a phone number or a national identifier is dropped, and the drop is counted. Nested objects are discarded whole rather than walked. Storing personal data outside the audited ledger is treated as a defect, not a convenience.

Submission safety

Ahead has a kill switch on automated submission that defaults to off — the question the code asks is "has this been explicitly enabled?", never "has it been disabled?". Nothing is submitted to an employer without your per-application approval.

Infrastructure

• Hosted on Cloudflare Workers with a Cloudflare D1 database, encrypted at rest and in transit.
• Secrets are held as platform secrets, never in the repository.
• Cross-origin access is restricted to an explicit allowlist; credentials are never granted to a wildcard origin.
• Error responses never return stack traces to the client, because those can carry session tokens, bound SQL parameters and email addresses.

Reporting a vulnerability

If you find a security problem, please tell us before telling anyone else, and give us a reasonable window to fix it. We will not pursue legal action against good-faith research that avoids privacy violations, service degradation and data destruction. Reach us through your account settings.